commit 59e5d30597a2038dee2f9c9f349cad34d4faab6a
author Marco Nelissen <marcone@google.com> Wed Jul 29 16:15:55 2015 -0700
committer The Android Automerger <android-build@google.com> Fri Aug 14 12:02:30 2015 -0700
tree b6df14b335a7b79cd39927e8d98787f485e91c30
parent 1809c2fe71ae4d7a96be5db3c54cb540f52daf24

Guard against codecinfo overflow

Bug: 21296336
Change-Id: I78be5141b3108142f12d7cb94839fa50f776d84a

media/libstagefright/MetaData.cpp

diff --git a/media/libstagefright/MetaData.cpp b/media/libstagefright/MetaData.cpp
index 74234a6..7d867b7 100644
--- a/media/libstagefright/MetaData.cpp
+++ b/media/libstagefright/MetaData.cpp
@@ -272,7 +272,12 @@
 
     mType = type;
     allocateStorage(size);
-    memcpy(storage(), data, size);
+    void *dst = storage();
+    if (!dst) {
+        ALOGE("Couldn't allocate %zu bytes for item", size);
+        return;
+    }
+    memcpy(dst, data, size);
 }
 
 void MetaData::typed_data::getData(

media/libstagefright/matroska/MatroskaExtractor.cpp

diff --git a/media/libstagefright/matroska/MatroskaExtractor.cpp b/media/libstagefright/matroska/MatroskaExtractor.cpp
index 4f0862c..9da835d 100644
--- a/media/libstagefright/matroska/MatroskaExtractor.cpp
+++ b/media/libstagefright/matroska/MatroskaExtractor.cpp
@@ -876,25 +876,38 @@
     size_t offset = 1;
     size_t len1 = 0;
     while (offset < codecPrivateSize && codecPrivate[offset] == 0xff) {
+        if (len1 > (SIZE_MAX - 0xff)) {
+            return ERROR_MALFORMED; // would overflow
+        }
         len1 += 0xff;
         ++offset;
     }
     if (offset >= codecPrivateSize) {
         return ERROR_MALFORMED;
     }
+    if (len1 > (SIZE_MAX - codecPrivate[offset])) {
+        return ERROR_MALFORMED; // would overflow
+    }
     len1 += codecPrivate[offset++];
 
     size_t len2 = 0;
     while (offset < codecPrivateSize && codecPrivate[offset] == 0xff) {
+        if (len2 > (SIZE_MAX - 0xff)) {
+            return ERROR_MALFORMED; // would overflow
+        }
         len2 += 0xff;
         ++offset;
     }
     if (offset >= codecPrivateSize) {
         return ERROR_MALFORMED;
     }
+    if (len2 > (SIZE_MAX - codecPrivate[offset])) {
+        return ERROR_MALFORMED; // would overflow
+    }
     len2 += codecPrivate[offset++];
 
-    if (codecPrivateSize < offset + len1 + len2) {
+    if (len1 > SIZE_MAX - len2 || offset > SIZE_MAX - (len1 + len2) ||
+            codecPrivateSize < offset + len1 + len2) {
         return ERROR_MALFORMED;
     }